Shared DB with tenant keys vs silos
Most B2B SaaS starts with shared schema plus strict tenant filters. Move to silos when compliance or noisy neighbors demand it—not because it sounds enterprise.
AuthZ everywhere
Never trust the client’s tenant ID. Derive tenancy from the session and enforce it in queries, jobs, and webhooks.
Migrations need tenant awareness
Backfills and cron jobs are classic leak points. Design batch jobs with the same isolation guarantees as the API.